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To date, the Examiner has not indicated that the subject matter of the information 
disclosure statement (JDS) filed June 7, 2006 has been properly considered. A copy of 
such IDS is submitted herewith. If the Examiner requires additional copies of any 
reference(s), applicant invites the Examiner to contact the imdersigned. Documentation 
itt the iSle wrapper of the instant application confirming the Examiner's consideration of 
the reference(s) is respectfully requested. 

The Examiner has rejected Claims 2-12, 14-15, 17-27, 29-30, 32-42, and 44-51 
imder 35 U.S.C. 1 12, second paragraph, as being indefinite for failing to particularly 
point out and distinctly claim the subject matter which applicant regards as the mvention. 
Applicant respectfully asserts that the rejection is avoided due to clarifications made to 
the claims hereinabove, 

The Examiner is thanked for the allowable subject matter of Claitns 48, and 49. 
The Examiner has objected to Claims 48, and 49 as being dependent on rejected claims. 
Applicant respectfully pomts out that Claims 48 and 49 have been amended into 
independent form to include the lunitation of intervening dependent Claim 46, as 
suggested by the Examiner. Thus, such claims are deemed allowed. 

The Examiner has rejected Claims 1, 5-8, 12-13, 15-16, 20-23, 27-28, 31, 35-38, 
42-43, and 50-51 under 35 U.S.C. 102(e) as being anticipated by Gryaznov et al. (U.S. 
Patent No. 6,748,534). Applicant respectfully disagrees with siich rejection* 

With respect to independent Claims 1,16, and 3 1 , the Examiner has relied on the 
Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to CoL 7, line 42 from the 
Gryaznov reference to make a prior art showing of applicant's claimed ''dividing said on- 
access malware scan into a plurality of tasks" (see this or similar, but not necessarily 
identical language in the foregoing independent claims). 
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Applicant respectfully asserts that the excexpts from Gtyaznov relied upon by the 
Examiner simply teach that '*[t]he header for the next news message 42 tn he arj^ntiftH is 
retrieved (block 104) by looking up the last read article number from the last read table 
68 (shewn in FIG, 3) for that newsgroup 43 and that news server 58, 59, 60" and "[o]nly 
news messages 42 which have yet been read tier have expired are scanned" (see Col. 7, 
lines 1-7-emphasis added). However, the mere disclosure by Gryaznov that the last read 
article number from the last read table is retrieved and only news messages that have not 
been read and are not expired are scanned simply fails to even suggest " dividing said oti- 
access malware scan into a pluralitv of tasks " (emphasis added), as claimed by applicant. 
Clearly, scanning news messages that have not been read and are not expired, as in 
Gryaznov, fails to even suggest an "on-access malware scan," as claimed by applicant, 

Further, with respect to independent Claims 1,16, and 3 1 , the Examiner has again 
relied on the Abstract; Figures 3-4C; Col, 2, lines 43-67; and Col. 5, line 1 to CoL 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
"issxiing said plurality of tasks to be performed by a plurality of different computers" (see 
this or similar, but not necessarily identical language in the foregoing independent 
claims). 

Applicant respectfully asserts that the excerpts in Gryaznov relied upon by the 
Examiner merely teach that "It]he threads table 67 maintained in the centralized database 
65 (shown in FIG. 3Y is accessed to determine whether the current file thread is locked 
from access bv other virus scanners 54, 55^ 56" (see CoL 7, lines 1 8-22-emphasis added). 
In addition, Gryaznov teaches that "[i]f the file thread is locked (block 110), another 
thread is selected (block 109)" and "[ilf the file thread is available, the file thread is 
locked (block 1 II) by adding an entry to the threads table 67" (see Col. 7, lines 22-25- 
emphasis added). Clearly, the mere disclosure that a virus scanner deteimines if the 
current file thread is locked from access and locks the thread if it is available, as in 
Gryaznov, fails to even suggest ' issuing said plurality of tasks to be performed by a 
plurality of different computers" (emphasis added), as claimed by applicant. 
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In addition, with respect to independent Claims 1, 16, and 31, the Examiner has 
relied on the Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to Col. 7, line 
42 fiom the Gryaznov reference to naake a prior art showing of applicant's claimed 
"collaling a plurality of task results corresponding to said plurality of tasks and received 
from said plurality of different computers to form a scan result corresponding to said on- 
access malware scan." (see this or similar, but not necessarily identical language in the 
foregoing independent claims - as amended). 

Applicant respectfully asserts that the excerpts from Gryaznov relied upon by the 
Examiner merely teach that "[i]f any of the downloaded files are infected (block 1 17), a 
warning message is generated (block 1 1 8)" and that "each virus scanner 54, 55, 56 
maintains a log file and posts an appropriate warning to the affected newsgroups 43'^ (see 
Col. 7, Imes 37-42-emphasis added). However, the simply disclosing generating a 
warning message if any downloaded files are infected, maintaining a log file, and posting 
a warning to affected newsgroups, as in Gryaznov, simply fails to even suggest 
"collating a plurality of task results," let alone where such task results ^'[correspond] to 
said plurality of tasks and [are] received from said plurality of different computers [and 
are collated] to form a scan residt corresponding to said on-access malware scan" 
(emphasis added), as claimed by applicant. 

Further, with respect to independent Claims 13, 28, and 43, the Examiner has 
relied on the Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to Col. 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
technique "wherein said malware scanning task is oDe of a plurality of malware scanning 
tasks that are each part of said on-access malware scan'' (see this or similar, but not 
necessarily identical language in the foregoing independent claims). 

Applicant respectfully asserts that the excerpts from Gryaznov relied upon by the 
Examiner simply teach that "[e]ach of the virus scamicrs 54^ 55, 56 operate 
independentlv of each other and therefore create the potential for multiple virus scanners 
54, 55, 56 attempting to scan different parts of the same multi-part news message " (see 
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Col 6y lines 25-29-eniphasis added). However, the mere disclosure that virus scanners 
operate independently of each other and may attempt to scan different parts of the same 
multi-part news message, as in Gryaznov, fails to even suggest a technique "wherein said 
mal ware scanning task is one of a plurality of maJware scanning tasks that are each part 
of said on-acces8 malware scan" (emphasis added), as claimed by applicant. 

In addition, with respect to independent Claims 13, 28, and 43, the Examiner has 
relied on the Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to Col. 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
technique *Svherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan" (see this or similar, but not necessarily identical langxmge 
in the foregoing independent claims). 

Applicant respectfully asserts that the excerpts from Giyaznov relied upon by the 
Examiner merely teach that "[i}f any of the downloaded files are infected (block 1 17), a 
warning message is generated (block 1 1 8)" and that "each virus scanner 54, 55, 56 
maintains a log file and posts an appropriate warning to the affected newsgroups 43" 
(emphasis added). However, the mere disclosure of generating a warning message if any 
of the downloaded files are infected, maintaining a log file, and posting a warning to the 
affected newsgroups, as in Gryaznov, simply fails to even suggest a technique 'Svherein a 
pluralitv of malware sc anrn'np; tagV ri^ftititg corresponding to said plurality of malware 
scanning tasks are collated to form a scan result corresponding to said on-access malware 
scan" (emphasis added), as claimed by applicant. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co, Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
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Co.868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the above reference, as noted above. 
Thus, a notice of allowance or a proper prior art showing of each of the foregoing 
claimed features is respectfully requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims, For example, with respect to Claim 1 0 et al., the Examiner has 
rejected the same under 35 U.S.C. 103(a) as being unpatentable over Gryaznov in view of 
Gartside (U.S. Patent No. 6,851,058). Specifically, the Examiner has relied on CoL 6, 
lines 17-65 fi-om the Gartside reference to make a prior art showing of applicant's 
claimed technique "wherein said on-access malware scan is not further divided if said on- 
access malware scan is detected as having a complexity below a predetermined threshold 
level" (as amended). 

Applicant respectfully asserts that the excerpt from Gartside relied upon by the 
Examiner merely teaches that "[i]f the tests 304, 320, 322, 324 indicate the archive does 
not contain sub-archives, does not have an excessive de-compressed size, does not 
contain a large number of files, and does not have too many file types, then the archive is 
considered to be safe, and it is set 326 to with a normal scanning priority" (emphasis 
added). Clearly, the mere disclosure that an archive without sub-archives, an excessive 
de-compressed size, a large number of files, and too many file types is considered to be 
safe and _s_et with a normal scanning nrioritv, as in Gartside^ fails to even suggest an "on- 
access malware scan [that] is not further divided," as ^pellant claims, let alone a specific 
technique 'Vherein said on-access malware scan is not further divided if said on-access 
malware scan is detected as having a complexity below a predetermined threshold level" 
(emphasis added), as claimed by applicant 

To estabhsh a prima facie case of obviousness, three basic criteria must be met 
First, there must be some suggestion or motivation, either in the references themselves or 
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in the knowledge generally available to one of oxdinary skill in the art, to modify the 
reference or to combine reference teachiiigs. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438(Fed.Cir.l991). 

Apphcant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest ^ of the claim limitations, as noted above. Thus, a notice of 
allowance or specific prior art showing of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectfully requested. 

To this end, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the imdersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No, NAI1P466/01. 042.01). 



P.O. Box 721120 




San Jose, CA 95172-1120 
408-505-5100 
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